FCC drops Google investigation over WiFi snooping, issues small fine

Citing deliberate efforts to interfere with its investigation of Google's …

The FCC has dropped its investigation of Google's collection of WiFi "payload data" as part of the company's Street View project, but has slapped the company with a $25,000 fine for obstructing its investigation. The investigation sought to determine if Google had improperly collected and stored personal information from traffic over unsecured personal WiFi networks, including e-mail, text messages, and webpage requests. An investigation by the Federal Trade Commission was dropped in October of 2010, just as the FCC took up its own.

In a notice dated April 13, released in a partially redacted form (PDF) on April 15 by the FCC, the commission claimed, "For many months, Google deliberately impeded the (FCC Enforcement) Bureau's investigation by failing to respond to requests for material information and to provide certifications and verifications of its responses." In the notice, the FCC added that it had no further plans for enforcement action on the matter—in part because the Google engineer who developed the code used to collect and store WiFi data "invoked his Fifth Amendment rights and declined to testify."

The FCC also said that it determined, lacking further information on the nature of the collection, that there was no precedent for applying the laws under which the investigation was launched—the Wiretap Act and the Communications Act—because the traffic intercepted by Google was not encrypted.

TheNew York Times reports that on Sunday, a Google spokesperson called the data collection "a mistake...but we believe we did nothing illegal."

Google just reported close $3 billion in quarterly profits. $25,000 will not be noticed by them.

However, if my company had been fined $25,000, it would have been.

Exactly. Fines should be a percentage of profits/income or a low set amount, whichever is greater. I'm tired of seeing corporations/celebrities/etc get fined what amounts to pocket change for them. $25,000 isn't a deterent at all for Google, but a percentage of their income would have been.

Or, another possibility is that the charge of obstruction is baseless and someone at FCC is just annoyed that google didn't roll over. In this hypothetical scenario, 25k fine might be chosen as it is small enough that google mightn't bother fighting it, but big enough that it is noted in some sort of FCC case log.

(I have no evidence that this is true, but it also would not surprise me.)

Basically, google was under no direct obligation to comply. There were not court orders, and Google is not technically under any jurisdiction of the FCC. Essentially, if the FCC did find something, it would still have required the FBI to bring a formal case, and/or the DoJ, and run a regular trial. Given, as they said, it was unencrypted data from insecured APs, ods are there would have been no resulting punishment anyway.

This was an "informal" investigation. I assume the value ofthe fine was chosen because it is simply small enough to not be worth Google challenging the authority of the FCC to not pay it, and large enough to cover at least some portion of their manpower cost for sending a few mean sounding letters back and forth.

I do think it tragic the data was colected, and there shuoold be some standard or law in place here, but since there is not, and was not at the time, and since the data once discovered was fairly destroyed, and contained little PII anyway, it didn;t even fall under most data collection laws to start with. I don;t think any formal case against google COULD have been successful. Good to hear we're not wasting more taxpayer dollars on it, so hopefully we can focus on formal regulation to correct the matter for the future.

Not 100% on this but didn't Google just pick up data that was being broadcast on unencrypted networks, if an individual did this, they wouldn't even get the fine as long as they didn't use the data for anything illegal like identity theft, so why would it be any different for a company?

Not saying that the snooping was perfectly innocent but it just doesn't seem to be illegal,if someone listens in and jots down your personal info as you scream it from the rooftops,they don't get fined or jailed and this case seems to be the digital equivalent.

Not 100% on this but didn't Google just pick up data that was being broadcast on unencrypted networks, if an individual did this, they wouldn't even get the fine as long as they didn't use the data for anything illegal like identity theft, so why would it be any different for a company?

Not saying that the snooping was perfectly innocent but it just doesn't seem to be illegal,if someone listens in and jots down your personal info as you scream it from the rooftops,they don't get fined or jailed and this case seems to be the digital equivalent.

They didn't get a fine for snooping but for obstructing the FCC's investigation into their practices.

It seems to be accepted already that Google really didn't do anything wrong, so I may be beating a dead horse here, but... if Google had Street Viewed my neighborhood, and I heard my neighbors complaining that they may have collected wifi packets, I would be the guy going "Really? You broadcast that stuff every day since you've had a wireless router to whoever might be wandering by, and you're worried that Google may have overheard it too?"

Yet another case of people not understanding the technology they're using. Maybe wireless routers should come with an informative clause in the EULA stating that running an unsecured AP is guaranteed to broadcast your network activity throughout a given radius. At least then we could point to the EULA in a case like this and say "You knew what you were signing up for!"

a little OT but how do you collect such info (text, email etc) from wireless networks?.Is it easy?.

It's called being a road-warrior (or wardriving). Grab your laptop, connect to your favorite neighbor's unsecured wifi, run a promiscuous packet sniffer, and bam, you've got every bit of data coming off that network. If scanning through raw packet data, Matrix-style, isn't your thing, I'm sure there's plenty of tools out there that will automagically reassemble the raw packets you're intercepting back into easily-readable formats (email, images, etc.).

Just don't say I didn't warn you when all of the sudden you have a very different opinion of the Joneses next door. It may be their own fault for broadcasting it, but it's your fault for actively listening to something you may not have wanted to hear (or viewing something you may not have wanted to see, as the case may be) ;] It's kind of like peering into their window from your own yard when they forgot to close the curtains on Friday night. That is of course if it took any extra effort on your part to do the peering, other than just glancing over. There's a difference between broadcasting something that must be reassembled to be understood, and broadcasting something that's immediately readable by the human senses.

Not saying that the snooping was perfectly innocent but it just doesn't seem to be illegal,if someone listens in and jots down your personal info as you scream it from the rooftops,they don't get fined or jailed and this case seems to be the digital equivalent.

They didn't get a fine for snooping but for obstructing the FCC's investigation into their practices.

Ah true, I read that and forgot it instantly, I just haven't had my coffee yet -_-But yeah the $25,000 seems fairly reasonable for covering the FCC's costs.

mmseng wrote:

...if Google had Street Viewed my neighborhood, and I heard my neighbors complaining that they may have collected wifi packets, I would be the guy going "Really? You broadcast that stuff every day since you've had a wireless router to whoever might be wandering by, and you're worried that Google may have overheard it too?"

Agreed, if you're broadcasting all your network traffic in the clear over a 50m+ radius,anyone in range with a laptop and some free software can see everything you do;Google is the least of your worries asshole!

Note that in the defense business, you pull some crap, and you get to stay out of government contract bidding for a while. One suspects Google is still getting plenty of government business, including those NSA/CIA contracts that good doesn't comment on.

Google just reported close $3 billion in quarterly profits. $25,000 will not be noticed by them.

However, if my company had been fined $25,000, it would have been.

Exactly. Fines should be a percentage of profits/income or a low set amount, whichever is greater. I'm tired of seeing corporations/celebrities/etc get fined what amounts to pocket change for them. $25,000 isn't a deterent at all for Google, but a percentage of their income would have been.

Well, the % thing wouldn't be fair. If each person does the same crime, they should be punished the same. Otherwise you start to unfairly punish people just b/c they have privilage.

However, on the flip-side, with lots of things like this having set fines or fines within X-Y amounts, large companies just sit around with risk assessors punching those fines into spreadsheets and flow charts, where-by companies decide if they can afford to skirt the law or be bad seeing as the pay-off for getting what they want is greater than he fines they'll have to face if they get caught.

That's why a lot of companies just don't give a crap about the law. Everything is just a cost-benefit equation to them. If the benefit outweighs the cost, they go for it. Granted, some companies don't take into account intangible things, like damage to company image, but a lot of companies just focus on the tangible, bottom-line.

Of course, we do it every day ourselves, too. If we knew we were going to get fined $20/mile over the speed limit, we'd risk-assess how fast we could go over the speed limit each month and not break our budget. Most folks do it without even thinking about the math. They figure the benefit of speeding all the time is worth the risk of a $200 ticket occasionally.

But, when you ramp it up to the corporate level, with highly trained folks doing this kind of analysis, it's a bit scary how immoral it can start sounding.

"Meh, just dump the waste into the river. We'll pay the $10,000/month fine, b/c it's cheaper than paying $50k/month to properly dispose of it."

Google just reported close $3 billion in quarterly profits. $25,000 will not be noticed by them.

However, if my company had been fined $25,000, it would have been.

Exactly. Fines should be a percentage of profits/income or a low set amount, whichever is greater. I'm tired of seeing corporations/celebrities/etc get fined what amounts to pocket change for them. $25,000 isn't a deterent at all for Google, but a percentage of their income would have been.

Well, the % thing wouldn't be fair. If each person does the same crime, they should be punished the same. Otherwise you start to unfairly punish people just b/c they have privilage.

However, on the flip-side, with lots of things like this having set fines or fines within X-Y amounts, large companies just sit around with risk assessors punching those fines into spreadsheets and flow charts, where-by companies decide if they can afford to skirt the law or be bad seeing as the pay-off for getting what they want is greater than he fines they'll have to face if they get caught.

That's why a lot of companies just don't give a crap about the law. Everything is just a cost-benefit equation to them. If the benefit outweighs the cost, they go for it. Granted, some companies don't take into account intangible things, like damage to company image, but a lot of companies just focus on the tangible, bottom-line.

Of course, we do it every day ourselves, too. If we knew we were going to get fined $20/mile over the speed limit, we'd risk-assess how fast we could go over the speed limit each month and not break our budget. Most folks do it without even thinking about the math. They figure the benefit of speeding all the time is worth the risk of a $200 ticket occasionally.

But, when you ramp it up to the corporate level, with highly trained folks doing this kind of analysis, it's a bit scary how immoral it can start sounding.

"Meh, just dump the waste into the river. We'll pay the $10,000/month fine, b/c it's cheaper than paying $50k/month to properly dispose of it."

Well you already dismissed his solution as unfair, so what's your point?.Do you have a better one?.

These people are fucking stupid. If what was done is not illegal, then they have no business fining them.

Don't get me wrong: I think it was stupid of Google, but it wasn't illegal. If a private citizen had've done it, they would be free and clear and be able to tell the FCC to suck a dick (though, not over the public airwaves/phone lines, because that's illegal).

Google just reported close $3 billion in quarterly profits. $25,000 will not be noticed by them.

However, if my company had been fined $25,000, it would have been.

Exactly. Fines should be a percentage of profits/income or a low set amount, whichever is greater. I'm tired of seeing corporations/celebrities/etc get fined what amounts to pocket change for them. $25,000 isn't a deterent at all for Google, but a percentage of their income would have been.

Well, the % thing wouldn't be fair. If each person does the same crime, they should be punished the same. Otherwise you start to unfairly punish people just b/c they have privilage.

Hmm. But our point is exactly that. With a fixed fine, the punishment is not exactly the same. The purpose of the fine is to be a deterrent, so it should hurt everyone equally. If I make an income of $50,000 year, a $25,000 fine is a lot bigger deal to me than to someone who makes $5,000,000. Shouldn't that person's fine also be 50% of their income? Wouldn't that be more equitable?

Google just reported close $3 billion in quarterly profits. $25,000 will not be noticed by them.

However, if my company had been fined $25,000, it would have been.

If you consider the proposed penalties for non-commercial file sharing (Thomas v. RIAA, etc.) then it makes...

Well, it makes even less sense.

Although, I'll say that in my experience, fines are more representative to the power of the agency than to the severity of the infraction. OSHA fines for practices that lead to employee fatalities have historically been much lower than EPA fines for pollution that could not be traced to any community health effects. Not that the fines by either agency typically cause much angst. If you want an agency to have power, then they need to be able to force consent decrees and/or shut down operations (like the DEA or FDA can).

The comment on lack of precedent for applying wiretap laws due to the fact that the data was unencrypted seems specious and unresearched. I recall many, many cases where people were prosecuted for accessing unencrypted networks and being convicted of wiretapping. Heck, I even remember studying cases about that in college, in being told "even if it's open, if you access it without permission, you're breaking the law."

Even more recently, there was a federal case (I think it was federal, anyway) that stated the act of passively connecting to an unprotected wifi network does not constitute wiretapping. (The case, iirc, had to do with wardriving, and the judge made a coparison to someone walking down the street with their phone's wifi turned on and configured to automatically connect to any available public network. The former was deemed prosecutable because of intent, whereas the latter was not because the user was not aware of the act. It was reported on Ars if someone wants to search and correct me. )

But regardless of this statement, I do agree that the current wiretap laws need to be revised to account for unprotected wi-fi networks, both public and private. It's just something nobody could have known about or considered back when these laws were written.

But regardless of this statement, I do agree that the current wiretap laws need to be revised to account for unprotected wi-fi networks, both public and private. It's just something nobody could have known about or considered back when these laws were written.

I don't know that I agree with that.

Just out of curiosity, if I owned a radio station and I told you not to listen to my radio station and you did anyways, should you be brought up on wiretapping?

What about if you are having a conversation and someone, regardless of whether they were TRYING to or not, overheard what you were talking about? Wiretapping?

I think at some point your expectations need to be realistic. If you want something private, at least do the minimal work necessary to make it considered private.

roken: Then why have the Fifth amendment if it's supposed to protect crimes?

Edit: To prevent wrongful conviction based on honest mistakes during testifying (accidental contradictions, missayings, etc) and such. You're allowed to stay silent if you don't believe you're able to defend your actions, even if you're innocent.

No, you invoke the fifth to avoid helping people prove anything against you, whether you did anything illegal or not.

If you're innocent, why would anything you say help prove anything?.

Ignoring the fact that people can twist your words, you can also invoke the Fifth so that you don't have to waste your time giving testimony when you know you did nothing wrong. I don't imagine that testifying to a government agency about your potential wrongdoing counts as a good time to most people. It's a nice snub if you don't accept their authority either.

They get away with this but countless people have been arrested and terrorized by the police for recording arrests. Millions of people's personal information in a deliberate operation compared to people recording the police in one isolated incident to make sure they are upholding the law, and the people recording to uphold the law go to jail under the wiretap act. What an absolute worthless joke the FCC is, corruption and hypocrisy served on a platter.

They get away with this but countless people have been arrested and terrorized by the police for recording arrests. Millions of people's personal information in a deliberate operation compared to people recording the police in one isolated incident to make sure they are upholding the law, and the people recording to uphold the law go to jail under the wiretap act. What an absolute worthless joke the FCC is, corruption and hypocrisy served on a platter.

How does your statement even make sense?What Google did was not illegal. An individual recording the police is not illegal, either.

They get away with this but countless people have been arrested and terrorized by the police for recording arrests. Millions of people's personal information in a deliberate operation compared to people recording the police in one isolated incident to make sure they are upholding the law, and the people recording to uphold the law go to jail under the wiretap act. What an absolute worthless joke the FCC is, corruption and hypocrisy served on a platter.

How does your statement even make sense?What Google did was not illegal. An individual recording the police is not illegal, either.

Also haven't a number of those arrests been overturned and deemed unconstitutional?

They get away with this but countless people have been arrested and terrorized by the police for recording arrests. Millions of people's personal information in a deliberate operation compared to people recording the police in one isolated incident to make sure they are upholding the law, and the people recording to uphold the law go to jail under the wiretap act. What an absolute worthless joke the FCC is, corruption and hypocrisy served on a platter.

How does your statement even make sense?What Google did was not illegal. An individual recording the police is not illegal, either.

Also haven't a number of those arrests been overturned and deemed unconstitutional?

Hmm. But our point is exactly that. With a fixed fine, the punishment is not exactly the same. The purpose of the fine is to be a deterrent, so it should hurt everyone equally. If I make an income of $50,000 year, a $25,000 fine is a lot bigger deal to me than to someone who makes $5,000,000. Shouldn't that person's fine also be 50% of their income? Wouldn't that be more equitable?

Minimum fine regardless of income + more if person makes a lot. Though I'd restrict it to traffic tickets.

I just paid $164 for "careless driving", which is BS since the reasons stated for it were all untrue (I was paying attention and crossing a solid white line is legal, contrary to what the highway patrol wrote). It was my fault but fining me $164 isn't going to stop me from making honest mistakes and become perfect at driving.

Hmm. But our point is exactly that. With a fixed fine, the punishment is not exactly the same. The purpose of the fine is to be a deterrent, so it should hurt everyone equally. If I make an income of $50,000 year, a $25,000 fine is a lot bigger deal to me than to someone who makes $5,000,000. Shouldn't that person's fine also be 50% of their income? Wouldn't that be more equitable?

Minimum fine regardless of income + more if person makes a lot. Though I'd restrict it to traffic tickets.

I just paid $164 for "careless driving", which is BS since the reasons stated for it were all untrue (I was paying attention and crossing a solid white line is legal, contrary to what the highway patrol wrote). It was my fault but fining me $164 isn't going to stop me from making honest mistakes and become perfect at driving.

Gripe off.

A better way is to tie it directly to the crime. In your case (well, in the case of someone breaking the law you purportedly did), to the vehicle. Regardless of how much you earn, having your car impounded or otherwise limited in driving ability hurts pretty much the same. It also creates the same punishment for breaking the law, just a different monetary value to that punishment. Although one thing about fines is that they're annoying to get regardless how much you have to actually pay, which is a disincentive.

In Google's case, if they were found guilty it should relate to scope. They were snooping across the entire country, whereas a company earning $100k-1m a year probably wouldn't be able to do that. And even in the case of obstructing the investigation, the scale they must have done it on would be larger, so the fine should scale up. But there are still non-monetary downsides, the case itself dragged Google's name through the mud, which will hurt them a more than even a 100 fold increase to this fine.

A good point, but everyone is missing out of the flexibility of the justice system. There is no possible way to implement a fine that is acceptable in all cases. Several commenters have pointed this out, only to introduce more implausible alternatives. Static fines go unnoticed by the big guys, percentage fines ramp up way out of control for the big guys. There will always be a case where a neat little formula doesn't take something into account, and you end up with a ridiculous outcome.

They're called judges for a reason. A lot of cases simply need some people to sit down and take a look at the facts to determine not only the outcome of the trial, but an appropriate punishment if necessary. They can look at scope, precedent, repeated offenses (a big one IMO), and any other factors that should have an effect on the outcome. We already pay these people (a lot) to make exactly these judgement. Not happy with the judgments? We have other branches designed to fix that if necessary.

The idea is sound. Whether it works as it should due to corruption, blubbering bureaucracy, etc. is another issue entirely.

On a sidenote, the number of misinformed attitudes toward the 5th amendment in this thread is disturbing.

Now I've had a look at the other responses, people seem confused at someone invoking their right not to give evidence. It happens regularly, and lawyers will often advise their clients not to take the stand in their own defence. Why? Because even if you're innocent, you can be made to look incredibly guilty by a good prosecutor. Just as importantly, you can make yourself look guilty without the help of that prosecutor - it's easy to say something that can then be taken out of context by the listener, especially when you're talking about a subject that's extremely technical and the listener is not an expert.

So don't start saying that "invoking the 5th" = "guilty" until you've had your own opportunity to screw your life up in one simple sentence.

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.